The manifest (manifest.json.zst) is compressed but NOT encrypted. It contains:
Blob hashes
Blob compressed sizes
Blob count
Total compressed size
Timestamp
Anyone with read access to the S3 bucket can see how many blobs a snapshot has, their sizes, and when the backup was taken. The database (db.zst.age) IS encrypted, so file paths and names are protected.
This should at minimum be documented as a known limitation. Ideally, the manifest should also be encrypted (it is only needed for operations that already require the private key, except for shallow verify and list).
The manifest (`manifest.json.zst`) is compressed but NOT encrypted. It contains:
- Blob hashes
- Blob compressed sizes
- Blob count
- Total compressed size
- Timestamp
Anyone with read access to the S3 bucket can see how many blobs a snapshot has, their sizes, and when the backup was taken. The database (`db.zst.age`) IS encrypted, so file paths and names are protected.
This should at minimum be documented as a known limitation. Ideally, the manifest should also be encrypted (it is only needed for operations that already require the private key, except for shallow verify and list).
Ref: parent issue #1
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The manifest (
manifest.json.zst) is compressed but NOT encrypted. It contains:Anyone with read access to the S3 bucket can see how many blobs a snapshot has, their sizes, and when the backup was taken. The database (
db.zst.age) IS encrypted, so file paths and names are protected.This should at minimum be documented as a known limitation. Ideally, the manifest should also be encrypted (it is only needed for operations that already require the private key, except for shallow verify and list).
Ref: parent issue #1
no. it is needed for pruning.